This vulnerability involves a cross-site scripting flaw in the addStudent function of the view_students.php file in the Students Controller of hemant6488 CodeIgniter-StudentManagementSystem. Manipulating the Name parameter allows an attacker to inject and execute arbitrary scripts remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The project was notified early but has not issued a fix or official remediation guidance. No patch or workaround information is currently available, and the rolling release model complicates version tracking.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability requires user interaction (UI:P) and has low impact on confidentiality and integrity but can affect availability minimally. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should exercise caution when accepting input for the Name parameter and consider implementing temporary input validation or output encoding to mitigate XSS risks until an official patch is released.